more secure cert handling, login state refinement